CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- redhat cloudformsldap_fluff authentication bypass4.3 Medium
- linux kernelblock/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device...4.6 Medium
- cisco cloud portalThe nsAPI interface in Cisco Cloud Portal 9.1 SP1 and SP2, and 9.3 through 9.3.2, does not...4.0 Medium
- adobe flash player, opensuse, redhat enterprise linux desktop +5 more +7 moreThe Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on...8.8 High
- redhat openshift, openshift origin +1 moreThe lockwrap function in port-proxy/bin/openshift-port-proxy-cfg in Red Hat OpenShift Origin...3.6 Low
- fedoraproject sssd, redhat enterprise linux +1 moreSystem Security Services Daemon (SSSD) before 1.9.4, when (1) creating, (2) copying, or (3)...3.7 Low
- nec universal raid utilityNEC Universal RAID Utility 1.40 Rev 680 and earlier, 2.31 Rev 1492 and earlier, and 2.5 Rev 2244...9.0 High
- ibm data studioIBM Eclipse Help System (IEHS), as used in IBM Data Studio 3.1 and 3.1.1 and other products,...4.0 Medium
- ibm maximo asset management, maximo asset management essentials, smartcloud control desk +2 moreIBM Maximo Asset Management 7.5, Maximo Asset Management Essentials 7.5, and SmartCloud Control...6.5 Medium
- ibm maximo asset management, maximo asset management essentials, smartcloud control desk +2 moreIBM Maximo Asset Management 7.5, Maximo Asset Management Essentials 7.5, and SmartCloud Control...6.5 Medium
- ibm change and configuration management database, maximo asset management, maximo asset management essentials +4 more +6 moreIBM Maximo Asset Management 6.2 through 7.5, Maximo Asset Management Essentials 6.2 through 7.5,...6.5 Medium
- ibm smartcloud control deskIBM SmartCloud Control Desk 7.5 allows remote authenticated users to bypass intended access...6.5 Medium
- cisco ata 187 analog telephone adaptor, ata 187 analog telephone adaptor firmware +1 moreThe Cisco ATA 187 Analog Telephone Adaptor with firmware 9.2.1.0 and 9.2.3.1 before ES build 4...9.0 High
- openstack essex, folsom, canonical ubuntu linux +2 moreThe boot-from-volume feature in OpenStack Compute (Nova) Folsom and Essex, when using nova...6.5 Medium
- microsoft windows 7, windows server 2003, windows server 2008 +2 more +4 moreThe kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2,...7.2 High
- microsoft .net frameworkThe Windows Forms (aka WinForms) component in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4,...10.0 High
- bitbucket xnbdThe redirect_stderr function in xnbd_common.c in xnbd-server and xndb-wrapper in xNBD 0.1.0 allow...2.1 Low
- rubyonrails railsActiveRecord vulnerable to modification of protected model attributes4.3 Medium
- qtThe QSharedMemory class in Qt 5.0.0, 4.8.x before 4.8.5, 4.7.x before 4.7.6, and other versions...3.6 Low
- weathernews touchThe Weathernews Touch application 2.3.2 and earlier for Android allows attackers to obtain...4.3 Medium
- emc rsa archer smartsuite, rsa archer egrc +1 moreThe Silverlight cross-domain policy in EMC RSA Archer SmartSuite Framework 4.x and RSA Archer GRC...7.5 High
- redhat jboss enterprise application platform, jboss enterprise brms platform, jboss enterprise web platform +2 moreThe AuthorizationInterceptor in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web...4.9 Medium
- redhat jboss enterprise application platform, jboss enterprise brms platform, jboss enterprise web platform +2 moreThe SecurityAssociation.getCredential method in JBoss Enterprise Application Platform (EAP)...5.8 Medium
- redhat jboss enterprise application platform, jboss enterprise brms platform, jboss enterprise web platform +2 moreThe CallerIdentityLoginModule in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web...4.0 Medium
- ibm infosphere datastage, infosphere information server +1 moreThe client applications in the DataStage Administrator client in InfoSphere DataStage in IBM...6.5 Medium
- ibm infosphere information server, infosphere metadata workbench +1 moreInfoSphere Metadata Workbench (MWB) 8.1 through 8.7 in IBM InfoSphere Information Server 8.1, 8.5...6.5 Medium
- moodle, tinymce spellchecker php +1 morePHP Spellchecker addon for TinyMCE allows attackers to trigger arbitrary outbound HTTP requests5.0 Medium
- moodlecalendar/managesubscriptions.php in the Manage Subscriptions implementation in Moodle 2.4.x...5.5 Medium
- moodlelib.php in the Submission comments plugin in the Assignment module in Moodle 2.3.x before 2.3.4...6.4 Medium
- moodlereport/outline/index.php in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1...4.0 Medium
- moodlegrade/edit/outcome/edit_form.php in Moodle 1.9.x through 1.9.19, 2.1.x before 2.1.10, 2.2.x...4.0 Medium
- ge intelligent platforms proficy real-time information portalGE Intelligent Platforms Proficy Real-Time Information Portal does not restrict access to methods...5.0 Medium
- ge intelligent platforms proficy real-time information portalThe Portal installation process in GE Intelligent Platforms Proficy Real-Time Information Portal...5.0 Medium
- cisco 2000 wireless lan controller, 2100 wireless lan controller, 2500 wireless lan controller +4 more +6 moreCisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.235.3, 7.1 and 7.2...9.0 High
- cisco webex training centerCisco WebEx Training Center allow remote authenticated users to bypass intended privilege...4.0 Medium
- cisco webex training centerCisco WebEx Training Center allows remote authenticated users to remove hands-on lab-session...4.0 Medium
- 3s-smart software solutions codesys, 3s-software codesys runtime system, 3s-smart software solutions codesys control rte +4 more +6 more3S CoDeSys Improper Access Control9.8 Critical
- emc avamar, avamar plugin +1 moreEMC Avamar Client 4.x, 5.x, and 6.x on HP-UX and Mac OS X, and the EMC Avamar plugin 4.x, 5.x,...7.2 High
- ibm tivoli federated identity manager, tivoli federated identity manager business gateway +1 moreIBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.11, 6.2.1 before 6.2.1.3, and 6.2...4.3 Medium
- cisco adaptive security appliance, adaptive security appliance software, asa 1000v cloud firewall +1 more +3 moreCisco Adaptive Security Appliances (ASA) devices with firmware 8.x through 8.4(1) do not properly...6.3 Medium
- sambaSamba 4.0.x before 4.0.1, in certain Active Directory domain-controller configurations, does not...3.5 Low
- cisco telepresence video communication servers softwareCisco TelePresence Video Communication Server (VCS) X7.0.3 does not properly process certain...5.0 Medium
- google chromeGoogle Chrome before 24.0.1312.52 on Linux uses weak permissions for shared memory segments,...7.5 High
- google chromeGoogle Chrome before 24.0.1312.52 does not properly maintain database metadata, which allows...6.4 Medium
- google chromeGoogle Chrome before 24.0.1312.52 on Mac OS X does not use an appropriate sandboxing approach for...5.0 Medium
- google chrome, opensuse +1 moreGoogle Chrome before 24.0.1312.52 allows remote attackers to bypass the Same Origin Policy via a...5.0 Medium
- oracle jdk, jre +1 moreUnspecified vulnerability in Oracle Java 7 before Update 11 allows remote attackers to affect...10.0 High
- rubyonrails rails, ruby on rails, debian linux +2 moreActive Record allows bypassing of database-query restrictions6.4 Medium
- mozilla firefox, seamonkey +1 moreMozilla Firefox before 18.0 on Android and SeaMonkey before 2.15 do not restrict a touch event to...5.8 Medium
- canonical ubuntu linux, opensuse, oracle java runtime environment (jre) +2 more +4 moreMultiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute...10.0 High
- Show moreLoading…